phase:1,\
  nolog,\
  pass,\
  t:none,\
  setvar:tx.inbound_anomaly_score_threshold=5,\
  setvar:tx.outbound_anomaly_score_threshold=4"


# The anomaly scores for the request and the responses are generally summed up
# and evaluated at the end of phase:2 and at the end of phase:4 respectively.
# However, it is possible to enable an early evaluation of these anomaly scores
# at the end of phase:1 and at the end of phase:3.
#
# If a request (or a response) hits the anomaly threshold in this early
# evaluation, then blocking happens immediately (if blocking is enabled) and
# the phase 2 (and phase 4 respectively) will no longer be executed.
#
# Enable the rule 900120 that sets the variable tx.blocking_early to 1 in order
# to enable early blocking. The variable tx.blocking_early is set to 0 by
# default. Early blocking is thus disabled by default.
#
# Please note that blocking early will hide potential alerts from you. This
# means that a payload that would appear in an alert in phase 2 (or phase 4)
# does not get evaluated if the request is being blocked early. So when you
# disabled blocking early again at some point in the future, then new alerts
# from phase 2 might pop up.  (@since 3.3.1)
SecAction \
  "id:900120,\
  phase:1,\
  nolog,\
  pass,\
  t:none,\
  setvar:tx.blocking_early=1"

# Some well-known applications may undertake actions that appear to be
# malicious. This includes actions such as allowing HTML or Javascript within
# parameters. In such cases the CRS aims to prevent false positives by allowing
# administrators to enable prebuilt, application specific exclusions on an
# application by application basis.
# These application specific exclusions are distinct from the rules that would
# be placed in the REQUEST-900-EXCLUSION-RULES-BEFORE-CRS configuration file as

    
        if re.search("anomaly_score|paranoia_level", var):
            p["type"] = "select"
            p["select"] = "0=0 (off)|1=1 (standard)|2=2 (extended)|3=3 (excessive)|4=4 (banking sector)|5=5 (absurd)"
        if var == "id":
            p["type"] = "select"
            p["select"] = "5999=5999|900999=900999"
        elif re.search("tx\.(block_|crs_excl|enforce_|do_|crs_validate|blocking_early)", var): # re.match("^[01]$", val) or re
            p["type"] = "bool"
        elif len(p["value"]) >= 50:
            p["type"] = "text"
            

        pmd1[p["name"]] = p
  

        "1": "1 (standard)",
        "2": "2 (extended)",
        "3": "3 (excessive)",
        "4": "4 (banking sector)",
        "5": "5 (absurd)"
    }
}
setvar['tx.blocking_early'] = {
    "id": "900120",
    "name": "tx.blocking_early",
    "description": "The anomaly scores for the request and the responses are generally summed up",
    "type": "bool",
    "value": "1",
    "help": "The anomaly scores for the request and the responses are generally summed up\nand evaluated at the end of phase:2 and at the end of phase:4 respectively.\nHowever, it is possible to enable an early evaluation of these anomaly scores\nat the end of phase:1 and at the end of phase:3.\nIf a request (or a response) hits the anomaly threshold in this early\nevaluation, then blocking happens immediately (if blocking is enabled) and\nthe phase 2 (and phase 4 respectively) will no longer be executed.\nEnable the rule 900120 that sets the variable tx.blocking_early to 1 in order\nto enable early blocking. The variable tx.blocking_early is set to 0 by\ndefault. Early blocking is thus disabled by default.\nPlease note that blocking early will hide potential alerts from you. This\nmeans that a payload that would appear in an alert in phase 2 (or phase 4)\ndoes not get evaluated if the request is being blocked early. So when you\ndisabled blocking early again at some point in the future, then new alerts\nfrom phase 2 might pop up.  (@since 3.3.1)"
}
setvar['tx.crs_exclusions_cpanel'] = {
    "id": "900130",
    "name": "tx.crs_exclusions_cpanel",
    "description": "Modify and uncomment this rule to select which application:",
    "type": "bool",
    "value": "1",
    "help": "Modify and uncomment this rule to select which application:"

}


#-- group
def mk_groups():
    plugins = {}
    groups = [
        ["global", "module", "CoreRuleSet variables", "Update CRS setvars in\n", "^id|^fn|tx\.paranoia|executing|sampling|score_threshold|early"],
        ["allow", "allowdeny", "Allowed/Restricted", "White and blacklist some HTTP parameters", "allowed|restricted|urlencoded|static_ext"],
        ["args", "args", "Arguments", "GET and POST parameter restrictions", "args|arg_|file_size|utf8"],
        ["excl", "exclusion", "Exclusions", "Some rules to skip (this should have been tags, but here we are)", "exclusions"],
        ["class", "classification", "Paranoia level classification", "Assign default levels", "anomaly_score(?!_threshold$)"],
        ["else", "setvar:else", "Other flags", "RBL blocking and DOS protection", "-"]
    ]
    """